1935004 - ThreadSanitizer: data race [@ nsThreadPool::Run] vs. [@ mozilla::net::ResolveHTTPSRecord] on Ubuntu 18.04

Reporter

Description

•

1 year ago

Found with m-c 20241203-d140333670bc (--enable-thread-sanitizer --enable-fuzzing)

This was found by simply launching the build headless in docker ubuntu:18.04. It doesn't repro for me in ubuntu 20.04 or debian 12.

STR:

$ docker run --rm -it ubuntu:18.04
# apt update
# apt install --no-install-recommends ca-certificates curl firefox xvfb xz-utils
# curl --fail -L "https://github.com/indygreg/python-build-standalone/releases/download/20241016/cpython-3.12.7+20241016-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz" | tar -xvz
# ./python/bin/pip3 install pipx
# ./python/bin/pipx run fuzzfetch --tsan --fuzzing --build d140333670bc
# ./python/bin/pipx run ffpuppet ./m-c-20241203162108-fuzzing-tsan-opt/firefox --headless -d

WARNING: ThreadSanitizer: data race (pid=4929)                                                                                                                                                                                                                                   
  Write of size 8 at 0x72240021a980 by thread T109:                                                                                                                                                                                                                              
    #0 realloc /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:699:5 (firefox-bin+0xd487a) (BuildId: fd6cdca9414f0057c519103f8b8eaf8d7bf5922d)                  
    #1 __libc_dynarray_emplace_enlarge <null> (libc.so.6+0x9d348) (BuildId: f7307432a8b162377e77a182b6cc2e53d771ec4b)                                                                                                                                                            
    #2 nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:346:15 (libxul.so+0x366874a) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)                                                                                                     
    #3 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1153:16 (libxul.so+0x366027c) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)                         
    #4 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10 (libxul.so+0x3666514) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)               
    #5 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:299:20 (libxul.so+0x41639fe) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)  
    #6 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x40e1b68) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)                   
    #7 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x40e1b68)                                                                                                                                                               
    #8 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x40e1b68)                                                                                                                                                       
    #9 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:366:10 (libxul.so+0x365be73) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)
    #10 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:191:3 (libnspr4.so+0x4b0c8) (BuildId: 2538e295685b791ff96ce7d4651b136fdf4ad9f8)
                                                                                                                                        
  Previous write of size 8 at 0x72240021a980 by thread T105:
    #0 realloc /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:699:5 (firefox-bin+0xd487a) (BuildId: fd6cdca9414f0057c519103f8b8eaf8d7bf5922d)
    #1 __libc_dynarray_emplace_enlarge <null> (libc.so.6+0x9d348) (BuildId: f7307432a8b162377e77a182b6cc2e53d771ec4b)
    #2 mozilla::net::ResolveHTTPSRecord(nsTSubstring<char> const&, nsIDNSService::DNSFlags, mozilla::Variant<mozilla::Nothing, CopyableTArray<nsTString<char>>, CopyableTArray<mozilla::net::SVCB>>&, unsigned int&) /builds/worker/checkouts/gecko/netwerk/dns/GetAddrInfo.cpp:5
09:10 (libxul.so+0x391c67a) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)
    #3 nsHostResolver::ThreadFunc() /builds/worker/checkouts/gecko/netwerk/dns/nsHostResolver.cpp:1949:25 (libxul.so+0x396e100) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)
    #4 operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18 (libxul.so+0x35201b9) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)
    #5 __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14 (libxul.so+0x35201b9)
    #6 __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14 (libxul.so+0x35201b9)
    #7 __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14 (libxul.so+0x35201b9)
    #8 apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14 (libxul.so+0x35201b9)
    #9 apply<FdWatcher, void (FdWatcher::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12 (libxul.so+0x35201b9)
    #10 mozilla::detail::RunnableMethodImpl<nsUpdateProcessor*, void (nsUpdateProcessor::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13 (libxul.so+0x35201b9)
    #11 nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:456:14 (libxul.so+0x3668b16) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)
    #12 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1153:16 (libxul.so+0x366027c) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)
    #13 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10 (libxul.so+0x3666514) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)
    #14 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:299:20 (libxul.so+0x41639fe) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)
    #15 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x40e1b68) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)
    #16 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x40e1b68)
    #17 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x40e1b68)
    #18 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:366:10 (libxul.so+0x365be73) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)
    #19 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:191:3 (libnspr4.so+0x4b0c8) (BuildId: 2538e295685b791ff96ce7d4651b136fdf4ad9f8)
...

Tyson Smith [:tsmith]

Updated

•

1 year ago

Group: core-security → network-core-security

Jesse Schwartzentruber (:truber)

Reporter

Comment 1

•

1 year ago

Attached file tsan_log.txt — Details

Jesse Schwartzentruber (:truber)

Reporter

Comment 2

•

1 year ago

This also reproduces on a TSan build at the same revision without --enable-fuzzing.

Jesse Schwartzentruber (:truber)

Reporter

Updated

•

1 year ago

Blocks: 1933975

Jesse Schwartzentruber (:truber)

Reporter

Updated

•

1 year ago

Blocks: tsan

Valentin Gosu [:valentin]

Updated

•

1 year ago

Severity: -- → S3

Priority: -- → P1

Whiteboard: [necko-triaged][necko-priority-queue]

Daniel Veditz [:dveditz]

Updated

•

1 year ago

Keywords: sec-moderate

Daniel Veditz [:dveditz]

Updated

•

1 year ago

Summary: ThreadSanitizer: data race [@ nsThreadPool::Run] vs. [@ mozilla::net::ResolveHTTPSRecord] → ThreadSanitizer: data race [@ nsThreadPool::Run] vs. [@ mozilla::net::ResolveHTTPSRecord] on Ubuntu 18.04

Kershaw Chang [:kershaw]

Assignee

Comment 3

•

1 year ago

#2 nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:346:15 (libxul.so+0x366874a) (BuildId: a5796110d68782ef530598e24bdbecc6bc1720fc)

This line indicates that this may be related to calling res_ninit here. However, the res_state used in ResolveHTTPSRecordImpl is a thread local object.
I think we don't need to always call res_ninit when a new DNS thread is created, I'll try to create a test build and see if it fixes this issue.

Kershaw Chang [:kershaw]

Assignee

Comment 4

•

1 year ago

Jesse, could you try to apply this patch and see if it fixes this issue?
Thanks.

Flags: needinfo?(jschwartzentruber)

Jesse Schwartzentruber (:truber)

Reporter

Comment 5

•

1 year ago

(In reply to Kershaw Chang [:kershaw] from comment #4)

I used the tsan build from your try push and got a slightly different stack:

WARNING: ThreadSanitizer: data race (pid=4582)                                                                                                                                                                                                                                   
  Write of size 8 at 0x723400186750 by thread T125:                                                                                                                                                                                                                              
    #0 realloc /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:699:5 (firefox-bin+0xc4315) (BuildId: a9798414ba02d42b0f4baa28a660387ab27d123e)                                                                                          
    #1 __libc_dynarray_emplace_enlarge <null> (libc.so.6+0x9d348) (BuildId: f7307432a8b162377e77a182b6cc2e53d771ec4b)                                                                                                                                                            
    #2 mozilla::net::ResolveHTTPSRecord(nsTSubstring<char> const&, nsIDNSService::DNSFlags, mozilla::Variant<mozilla::Nothing, CopyableTArray<nsTString<char>>, CopyableTArray<mozilla::net::SVCB>>&, unsigned int&) /builds/worker/checkouts/gecko/netwerk/dns/GetAddrInfo.cpp:5
09:10 (libxul.so+0x388286a) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                                                                                                                                                                                                  
    #3 nsHostResolver::ThreadFunc() /builds/worker/checkouts/gecko/netwerk/dns/nsHostResolver.cpp:1935:25 (libxul.so+0x38d3e30) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                                                                             
    #4 operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18 (libxul.so+0x34958b9) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                                                                                                            
    #5 __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14 (libxul.so+0x34958b9)
    #6 __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14 (libxul.so+0x34958b9)                      
    #7 __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14 (libxul.so+0x34958b9)
    #8 apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14 (libxul.so+0x34958b9)
    #9 apply<FdWatcher, void (FdWatcher::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12 (libxul.so+0x34958b9)                                                                                                                                    
    #10 mozilla::detail::RunnableMethodImpl<nsUpdateProcessor*, void (nsUpdateProcessor::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13 (libxul.so+0x34958b9)                                           
    #11 nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:456:14 (libxul.so+0x35d680e) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                                  
    #12 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1153:16 (libxul.so+0x35cdf2d) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                                    
    #13 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10 (libxul.so+0x35d41e4) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)
    #14 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:299:20 (libxul.so+0x40c151e) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)
    #15 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x40403e8) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                    
    #16 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x40403e8)                                                                                                                                                              
    #17 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x40403e8)                                                                                                                                                      
    #18 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:366:10 (libxul.so+0x35c9af3) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)
    #19 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:191:3 (libnspr4.so+0x4aef8) (BuildId: c9685bb66792f2d2281d86a557b0b40cc904756b)
                                                                                                                                                                                                                                                                                 
  Previous write of size 8 at 0x723400186750 by thread T119:                                                                                                                                                                                                                     
    #0 realloc /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:699:5 (firefox-bin+0xc4315) (BuildId: a9798414ba02d42b0f4baa28a660387ab27d123e)
    #1 __libc_dynarray_emplace_enlarge <null> (libc.so.6+0x9d348) (BuildId: f7307432a8b162377e77a182b6cc2e53d771ec4b)                                                                                                                                                            
    #2 mozilla::net::ResolveHTTPSRecord(nsTSubstring<char> const&, nsIDNSService::DNSFlags, mozilla::Variant<mozilla::Nothing, CopyableTArray<nsTString<char>>, CopyableTArray<mozilla::net::SVCB>>&, unsigned int&) /builds/worker/checkouts/gecko/netwerk/dns/GetAddrInfo.cpp:5
09:10 (libxul.so+0x388286a) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                                                                                                                                                                                                  
    #3 nsHostResolver::ThreadFunc() /builds/worker/checkouts/gecko/netwerk/dns/nsHostResolver.cpp:1935:25 (libxul.so+0x38d3e30) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                                            
    #4 operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18 (libxul.so+0x34958b9) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                                       
    #5 __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14 (libxul.so+0x34958b9)                
    #6 __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14 (libxul.so+0x34958b9)
    #7 __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14 (libxul.so+0x34958b9)             
    #8 apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14 (libxul.so+0x34958b9)
    #9 apply<FdWatcher, void (FdWatcher::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12 (libxul.so+0x34958b9)                              
    #10 mozilla::detail::RunnableMethodImpl<nsUpdateProcessor*, void (nsUpdateProcessor::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13 (libxul.so+0x34958b9)
    #11 nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:456:14 (libxul.so+0x35d680e) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                 
    #12 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1153:16 (libxul.so+0x35cdf2d) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                                                                              
    #13 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10 (libxul.so+0x35d41e4) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)                                                                                    
    #14 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:299:20 (libxul.so+0x40c151e) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)
    #15 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x40403e8) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)
    #16 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x40403e8)                                                                                                                                                              
    #17 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x40403e8)                                                                                                                                                      
    #18 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:366:10 (libxul.so+0x35c9af3) (BuildId: 9ee1f525f0cabd29042030701555e5977dc2b441)     
    #19 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:191:3 (libnspr4.so+0x4aef8) (BuildId: c9685bb66792f2d2281d86a557b0b40cc904756b)

Flags: needinfo?(jschwartzentruber)

Jesse Schwartzentruber (:truber)

Reporter

Comment 6

•

1 year ago

Attached file patch_tsan_log.txt — Details

(In reply to Jesse Schwartzentruber (:truber) from comment #5)

I used the tsan build from your try push and got a slightly different stack:

Confirmed with an updated build (based on 43d313539f5f) and only that patch applied. I get the same (newer) stacks.

Randell Jesup [:jesup] (needinfo me)

Updated

•

1 year ago

Assignee: nobody → rjesup

Randell Jesup [:jesup] (needinfo me)

Comment 7

•

1 year ago

I can repro using the instructions from comment 0

Randell Jesup [:jesup] (needinfo me)

Comment 8

•

1 year ago

Reproduces without docker on Fedora 41

Randell Jesup [:jesup] (needinfo me)

Comment 9

•

1 year ago

Ok, without Kershaw's patch, it hits the TSAN violation in 5s. With the patch, I ran for 2 hours with no hits.

Kershaw: so, do we need res_ninit()?

Flags: needinfo?(kershaw)

Kershaw Chang [:kershaw]

Assignee

Comment 10

•

1 year ago

(In reply to Randell Jesup [:jesup] (needinfo me) from comment #9)

Ok, without Kershaw's patch, it hits the TSAN violation in 5s. With the patch, I ran for 2 hours with no hits.

Kershaw: so, do we need res_ninit()?

hmm... but Jesse already tried my patch and it didn't work.

Jesse, could you test my patch again and see if you can still reproduce this?
Thank you.

Flags: needinfo?(kershaw) → needinfo?(jschwartzentruber)

Jesse Schwartzentruber (:truber)

Reporter

Comment 11

•

1 year ago

I also cannot reproduce anymore using your patch on m-c in an 18.04 container. Something must have changed between early Dec and now?

Flags: needinfo?(jschwartzentruber)

Kershaw Chang [:kershaw]

Assignee

Comment 12

•

1 year ago

(In reply to Jesse Schwartzentruber (:truber) from comment #11)

I also cannot reproduce anymore using your patch on m-c in an 18.04 container. Something must have changed between early Dec and now?

Thanks for testing. As far as I can tell, that code hasn't been changed recently.

Since that patch fixes this issue, I think we can try to land it?
Randell, do you mind if I take this bug and submit the patch?

Flags: needinfo?(rjesup)

Randell Jesup [:jesup] (needinfo me)

Comment 13

•

1 year ago

Go ahead!

Assignee: rjesup → kershaw

Flags: needinfo?(rjesup)

Kershaw Chang [:kershaw]

Assignee

Comment 14

•

1 year ago

Attached file Bug 1935004 - Remove res_ninit, r=#necko — Details

Pulsebot

Comment 15

•

1 year ago

Pushed by kjang@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/b9de0b8a1256 Remove res_ninit, r=necko-reviewers,valentin

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 16

•

1 year ago

https://hg.mozilla.org/mozilla-central/rev/b9de0b8a1256

Group: network-core-security → core-security-release

Status: NEW → RESOLVED

Closed: 1 year ago

status-firefox136: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 136 Branch

Daniel Veditz [:dveditz]

Comment 17

•

1 year ago

The code this is removing was added in 128 to fix bug 1895741. That, in turn, was modifying the crash fix in bug 1881437.

Will this patch reintroduce either of those, and if so which problem is better to have?
is this race worrying enough that we should back-port this fix to ESR-128. It's a Linux crash and a lot of Linux distros use the ESR branch.

status-firefox134: --- → wontfix

status-firefox-esr115: --- → unaffected

status-firefox-esr128: --- → affected

Flags: needinfo?(kershaw)

Ryan VanderMeulen [:RyanVM]

Updated

•

1 year ago

status-firefox135: affected → wontfix

tracking-firefox136: --- → +

tracking-firefox-esr128: --- → ?

Andrei Vaida [:avaida]

Updated

•

1 year ago

QA Whiteboard: [post-critsmash-triage]

Flags: qe-verify-

Kershaw Chang [:kershaw]

Assignee

Comment 18

•

1 year ago

(In reply to Daniel Veditz [:dveditz] from comment #17)

The code this is removing was added in 128 to fix bug 1895741. That, in turn, was modifying the crash fix in bug 1881437.

Will this patch reintroduce either of those, and if so which problem is better to have?

Please see this comment.
I think the actual fix for bug 1895741 was removing res_ninit here, not the part that calling res_ninit when new DNS thread created.
So, I think the answer to your question is no. This patch should not reintroduce the crash.

is this race worrying enough that we should back-port this fix to ESR-128. It's a Linux crash and a lot of Linux distros use the ESR branch.

Good point. I'll request an uplift. Thanks.

Flags: needinfo?(kershaw)

Donal Meehan [:dmeehan]

Updated

•

1 year ago

tracking-firefox-esr128: ? → 136+

Kershaw Chang [:kershaw]

Assignee

Comment 19

•

1 year ago

Attached file Bug 1935004 - Remove res_ninit, r=#necko — Details

Original Revision: https://phabricator.services.mozilla.com/D236345

Phabricator Automation

Updated

•

1 year ago

Attachment #9465159 - Flags: approval-mozilla-esr128?

Phabricator Automation

Comment 20

•

1 year ago

esr128 Uplift Approval Request

User impact if declined: This is a data race issue.
Code covered by automated testing: no
Fix verified in Nightly: yes
Needs manual QE test: no
Steps to reproduce for manual QE testing: N/A
Risk associated with taking this patch: Low
Explanation of risk level: Should be low risk, since we don't need to call res_ninit and res_nclose.
String changes made/needed: N/A
Is Android affected?: yes

Phabricator Automation

Updated

•

1 year ago

Attachment #9465159 - Flags: approval-mozilla-esr128? → approval-mozilla-esr128+

Pulsebot

Comment 21

•

1 year ago

uplift

https://hg.mozilla.org/releases/mozilla-esr128/rev/26ececdcfc75

Lando Automation

Updated

•

1 year ago

status-firefox-esr128: affected → fixed

Jesse Schwartzentruber (:truber)

Reporter

Updated

•

1 year ago

Updated

•

1 year ago

Whiteboard: [necko-triaged][necko-priority-queue] → [necko-triaged][necko-priority-queue][adv-main136+r][adv-esr128.8+r]

Daniel Veditz [:dveditz]

Updated

•

10 months ago

Group: core-security-release

tsan_log.txt 1 year ago Jesse Schwartzentruber (:truber) 25.83 KB, text/plain		Details
patch_tsan_log.txt 1 year ago Jesse Schwartzentruber (:truber) 27.87 KB, text/plain		Details
Bug 1935004 - Remove res_ninit, r=#necko 1 year ago Kershaw Chang [:kershaw] 48 bytes, text/x-phabricator-request		Details
Bug 1935004 - Remove res_ninit, r=#necko 1 year ago Kershaw Chang [:kershaw] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-esr128+	Details